Security is not a product, but a process.

learn more… | top users | synonyms (1)

0
votes
1answer
34 views

Azure SQL - Sudden connection spike

At first: This is my first question on Serverfault. I am not sure if it fits better on Information Security. If so, please leave a comment and I will move the question. Question My company is ...
0
votes
2answers
17 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
0
votes
1answer
13 views

Is it secure to do “chroot” SFTP directory without actually setting owner to be root?

I don't know if this sounds wrong, but I have a use case where I need to run a cron job and rsync the data into the SFTP file directory. Typically SFTP set up on the Internet would suggest to set the ...
0
votes
1answer
29 views

Google Apps password change not reflected across all devices

We have a paid Google Apps account and I recently changed the password for one of our users. I confirmed the password change by logging into gmail.com using the new password. The old password isn't ...
1
vote
0answers
13 views

I can installa “Ossec” on xenserver host? [closed]

I own a xenserver where the host is connected to the public ip network. I allow connections only from my static ip and deny amy other with iptables, but I can install monitoring system like Ossec ...
0
votes
0answers
14 views

Give a right to domain user to manage his system's firewall

How can a we give a right to domain user to manage his system's firewall? We're having a Windows setup, and using Windows Server 2012 for managing domain group policies.
3
votes
1answer
47 views

Debian - Warning: Possible LKM Trojan installed

I am running chkrootkit every night on 3:04. More than 1 year it was not returning any problems but 1 month ago this warning started to appear: ======================= Checking `lkm'... ...
0
votes
1answer
51 views

What users should have access to sudo? (node, php, ftp…)

Before I begin, feel free to suggest a better title for this question. I've registered on Digitalocean and installed a LEMP stack. This is my first time configuring a server from scratch. Even though ...
12
votes
3answers
2k views

Is it really secure to connect to a server by SSH from hotels during a journey?

Is it really secure to connect to a server using SSH from hotels during a journey? Server: - CentOS 7 - Authorisation only by RSA key - password auth is denied - Non-standard port Workstation: - ...
0
votes
1answer
23 views

XSS Vulnerability with PCI RapidComply

I have a website hosted on an Apache Tomcat 7 server that uses the Authorize.net gateway and merchant services to handle payment. I recently ran a required PCI Compliance test against my website, and ...
7
votes
1answer
198 views

Is is possible to disable Certificate Transparency (audit log checking) of certificates in Chrome?

We utilize HTTPS deep packet inspection in our firewall via a trusted root certificate in the Windows certificate store. Chrome recently pushed forward with a feature to perform additional checks on ...
0
votes
1answer
26 views

is there security risk when running tomcat7 on port 80

I have setup a server with tomcat7 running on port 80. I have googled around and found out that since port 80 is a "magic port" it needs root privileges to be bound. For this reason most comments i ...
0
votes
2answers
54 views

What IP address should I use for a device that I want to break network access to?

I have an IPMI server on a super micro motherboard that I am unable to disable. There is not even a jumper to disable this either. After seeing all of the security issues that the IPMI server they ...
0
votes
1answer
46 views

TCP Keepalive: Why does an idled ESTABLISHED connection end after 60 seconds, instead of tcp_keepalive_time?

I am investigating ways to mitigate a server against DoS-type attacks. In one scenario, I've opened several hundred TCP connections to my webserver. I do not send any data after the initial TCP ...
2
votes
2answers
35 views

Restrict access to .ssh folder over network shares

I run a small server running Ubuntu Server 14.04 and have just noticed that the .ssh folder in the users home directory is accessible via SMB and NFS. The SMB and NFS are both secured, however I ...
0
votes
1answer
19 views

Block/Prevent Adminer - Apache [duplicate]

I found out that if someone was able to hack any FTP account on my server and upload Adminer they could alter the database. I tried Google'ing a way to block or prevent Adminer from working, but got ...
0
votes
0answers
25 views

Subversion Edge Security Failure?

I've kept my Subversion Edge upgraded with the most recent binaries, whenever the latest release was I did it. I just created a new user and went to add him to the repository access rules and noticed ...
1
vote
2answers
73 views

From a technical perspective, is my data insecure when using a public VPN like SecurityKiss?

I wonder if I understand well VPN. I connected to SecurityKiss, they provide a list of TunnelBlick configs. In order you to connect their VPN. (TUnnelBlick is OpenVPN based). Am I right : your IP is ...
0
votes
2answers
19 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
1answer
62 views

auditctl buffer setting - how large is this?

Within the default audit.rules file on CentOS 5, 6 and 7, the following is set: # Increase the buffers to survive stress events. # Make this bigger for busy systems -b 320 However, there is no ...
0
votes
0answers
11 views

Deny Downloading of Files unless user is Authenticated

Here a bit of a simple on for someone I think but the answer has eluded me. I would like to prevent unauthenticated users from downloading files from my secure directory (/secure/) on my IIS 7 Web ...
0
votes
1answer
31 views

Nginx Default/Welcome Page Suddenly Returns

I installed Nginx a number of months ago and deployed some code. I obviously deleted the default index.html Nginx default page. I know this for certain as PHP was not installed and so index.html was ...
0
votes
1answer
45 views

Enforcing RC4 cipher and testing enabled ciphers with openSSL

I am trying to enable and enforce RC4 cipher on apche 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in below 2 ways 1. SSLCipherSuite ...
0
votes
2answers
43 views

Add custom 'allow' policy in SELinux

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy: allow httpd_t user_home_t:file execute; How do I turn ...
0
votes
3answers
61 views

Security concerns with enabling PowerShell on a production server [closed]

I work in the software development side of an ISV. We're thinking of using PowerShell for some utilities in and around the core application (which itself is ASP.NET). One of my colleagues said to me ...
0
votes
0answers
55 views

why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?

Most of the time when someone who is not authorized attempts to log on to my Windows 2008 R2 web server, an ip address is displayed. With the ip address, i can easily block the external host from ...
3
votes
2answers
88 views

How worried should I be about unsecured HTTP on a “private” network?

So I've joined a new team, which develops and operates a service available on the Internet. It's aimed at B2B use rather than consumer, although anyone can sign up for a low-tier account to check it ...
1
vote
2answers
63 views

site-to-site vpn tunnel - does hardware matter? [closed]

I have been tasked with setting up 4 offices and connecting them all together so they can be on the same network. Does hardware really matter or could I build a decent machine in the low $1000's and ...
0
votes
1answer
20 views

How to manage access to nodes in a cluster?

I am about to set up a server cluster for our company's web applications. At the beginning there will be 3 hardware servers in Proxmox HA setup in a remote datacenter running about 20-30 VMs all ...
0
votes
0answers
23 views

Garbage files in public_html folder. Is this a security breach? [duplicate]

The public_html folder on my site just got uploaded with a ton of garbage html files with filenames such as vonzipper-sunglasses-men-25jh27.html and tumi-daypack-04po59.html as well as several files ...
1
vote
1answer
44 views

MS CRM: How secure is an Internet Facing Deployment (IFD)?

From a security perspective, how secure is an IFD deployment of MS CRM 2013 or CRM 2015? I know it's the recommended way to expose MS CRM to the net, but what are the vulnerabilties? Is it ...
0
votes
2answers
25 views

How to handle passwords in a script: in-memory VS on-file

I have a script that runs on a VPS in a cheap cloud provider. The scenario is: I trust my provider, but I prefer to make his life hard if he ever wants to steal my key. All the interested folders in ...
0
votes
0answers
106 views

AWS security group egress rules for S3

I manually created a new security group using the AWS CLI. I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and ...
0
votes
1answer
15 views

Application Virtualization Risk Through WAN / Internet

I was weighing pros and cons about the new mission critical system that through application virtualization, will allow my colleagues from 3 different countries to access it. Here are some background ...
-2
votes
1answer
29 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
2
votes
5answers
279 views

How to prevent remote code execution from a domain member server?

Is there a way, using a firewall, Group Policy setting, or other control, to prevent someone logged into a domain member from being able to remotely execute code on a domain controller (that they ...
0
votes
1answer
72 views

Can I use an IAM role to grant my Heroku app access to my Amazon S3 bucket?

Heroku: Using AWS S3 to Store Static Assets and File Uploads suggests using my AWS security credentials to enable my Heroku app to access my Amazon S3 bucket. However, isn't it better practice (as ...
0
votes
1answer
29 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
1
vote
1answer
73 views

Minimizing attack surface on fresh 2012 R2

I'm in the following situation, i will have a fresh server connected to the internet (if required with a firewall between the net and it simply droping all packets on ports other than the one my ...
2
votes
2answers
115 views

Multi-site hosting security - ensure no scripts can run as Apache user, but only as each website's user

In setting up a hosting environment with multiple sites that should be isolated from each other, I did the obvious step of having PHP be configured so it runs as the user that's associated with each ...
0
votes
1answer
51 views

Do not allow all domain users to have access to a shared folder

This should be easy, but I just don't see it. And, first, I'm a programmer wearing the hat of an IT for lack of resource where I work (small company). I need to create a folder, inside our network ...
14
votes
4answers
2k views

Wipe is very slow. Too little entropy?

I have to hand off a Laptop including its hard disc. Since it was not encrypted I wanted to wipe it at least quickly. I know this is not optimal on SSD, but I thought better than just plain readable. ...
0
votes
1answer
38 views

How can I secure an insecure Meteor by using Nginx?

I have an insecure Meteor running on AWS. For those not familiar with Meteor, that means I am using the "insecure" package, which trades security for rapid prototyping. I only need our development ...
0
votes
1answer
47 views

Is it a security issue if I have GIT working copy in www?

If I checkout a working copy into the www root of my site, would that be a security vulnerability?
1
vote
1answer
16 views

Accept only new file uploads over SSH

We want to send files around between some linux hosts via OpenSSH, but we don't want clients to be able to list / retrieve / modify existing files on the server. In other words, it should be an ...
0
votes
1answer
52 views

Extra SSL Certificate For Database Server?

I have three servers: Web-Server Database Server Database Replication Server In the upcoming days, I am going to order a SSL certificate for the Web-Server to deliver the data encrypted to the ...
1
vote
1answer
34 views

Linux security implications for sudo, su to service account & add secondary group to admin Tomcat?

I have a named account to login to a Linux host. Tomcat is running under a Service Account named "tomcat" I periodically need to do admin functions like modify tomcat-users.xml which is configured ...
0
votes
1answer
69 views

How do you use a SOCKS proxy?

I intended to call this question: "Are SOCKS proxies still relevant?" but thought it would be too vague. I know there are various SOCKS proxies that are actively maintained and developed (like ...
0
votes
2answers
70 views

do i need to filter the OUTPUT with iptables for a dedicated firewall box?

I already know how to setup a firewall using iptables, but after a visit of the IT Security Department, they said i need to filter the OUTPUT, but, it is pointless to me, i really can find an scenario ...
0
votes
1answer
60 views

Strange SECCOMP entries for sshd in audit log

I'm seeing strange entries for sshd in my audit logs along the lines of: type=SECCOMP audit(1433519794.902:46): auid=20003 uid=22 gid=22 ses=21 pid=25136 comm="sshd" exe="/usr /sbin/sshd" sig=31 ...